我々はいかにして安全な 名前解決を手に入れるか / How do we get secure name resolution

Kyoto.なんか #4

Transcript

1. զʑ͸͍͔ʹͯ҆͠શͳ

   ໊લղܾΛखʹೖΕΔ͔
   itochan
   Kyoto.* #4
   

   View Slide

2. ͩΕ
   •౦ژͷେֶੜ
   •͸ͯͳΠϯλʔϯ 2016 ߦͬͯ·ͤΜ
   JUPDIBO
   !JDIBO
   

   View Slide

3. എܠ
   • ੈؒͰ͸HTTPSԽͷѹ͕ߴ·͍ͬͯΔ
   • ໊͔͠͠લղܾ͸ฏจ
   • DNSͷ௨৴ܦ࿏Λ҉߸Խ͍ͨ͠ʂʂʂ
   • ҆શҙࣝͷߴ·Γ
   

   View Slide

4. ͦ͜Ͱɺ
   

   View Slide

5. DNS over HTTPS (DoH)
   • HTTPSܦ༝Ͱ໊લղܾ͕Ͱ͖Δ
   • IETF Draftʹͳ͍ͬͯͯඪ४Խ։࢝
   • ࣮͸DNS over TLSͱ͍͏ͷ΋͋Δ
   • RFCͰඪ४Խ͞Ε͍ͯΔ (RFC 7858)
   

   View Slide

6. ✔ ྑ͍ͱ͜Ζ
   • ໊લղܾ΋ؚΊ௨৴Λ׬શʹ҉߸Խ͢Δ͜ͱ͕Մೳʂ
   • େֶͷճઢͰ΋҆৺͍ͯ͠ΖΜͳαΠτΛӾཡͰ͖Δ
   

   View Slide

7. ✘ ѱ͍ͱ͜Ζ
   • ໊લղܾʹएׯΦʔόʔϔου͕͋ΔʢͱݴΘΕ͍ͯΔʣ
   • TLS1.3Ͱղܾ͢Δ͔ʁ
   • ѱ͞Λ͍ͯ͠ΔͱࢥΘΕΔ
   

   View Slide

8. DNS over HTTPS ࢖͏ʹ͸
   • ࢖͑ͦ͏ͳͱ͜Ζ͸2ͭ
   • Google Public DNS: 8.8.8.8, 8.8.4.4
   • Cloudflare DNS: 1.1.1.1, 1.0.0.1
   

   View Slide

9. DNS over HTTPS ࢖͏ʹ͸
   • ࣍ͷFirefoxͰ͸CloudflareʹΑΔ

   DoHͷ໰͍߹ΘͤΛαϙʔτ͢ΔΒ͍͠
   • Android PͰ͸OSͰαϙʔτ͢ΔΒ͍͠
   • ϩʔΧϧʹΫϥΠΞϯτΛཱͯlocalhost:53 ʹ໰͍߹Θͤ
   

   View Slide

10. DNS over HTTPS ࢖͏ʹ͸
    • ࣍ͷFirefoxͰ͸CloudflareʹΑΔ

    DoHͷ໰͍߹ΘͤΛαϙʔτ͢ΔΒ͍͠
    • Android PͰ͸OSͰαϙʔτ͢ΔΒ͍͠
    • ϩʔΧϧʹΫϥΠΞϯτΛཱͯlocalhost:53 ʹ໰͍߹Θͤ
    ˣ͜Ε࠷ߴ
    

    View Slide

11. DNS over HTTPS ΫϥΠΞϯτ
    • Ͳ͔ͬͪೖΕΔ
    • stubby
    • cloudflared ←؆୯
    

    View Slide

12. ΍͍͖ͬͯ·͠ΐ͏
    

    View Slide

13. ͜Μͳײ͡
    

    View Slide

14. IUUQTUSBOTQBSFODZSFQPSUHPPHMFDPNIUUQTPWFSWJFX
    

    View Slide